GOPAX halts trading and withdrawals after hacking threat

What happened

South Korean cryptocurrency exchange GOPAX suspended trading, deposits and standard withdrawals on Friday after receiving an email that threatened a hack, according to reporting by Cointelegraph and Crypto.news, which both cited local newspaper Kyunghyang Shinmun.

Deposits and ordinary withdrawals were halted at 5:55 UTC, and trading stopped at 6:53 UTC, the exchange said in separate notices. All unfilled orders were canceled. A GOPAX representative told Kyunghyang Shinmun that no hack or attempted theft had taken place at the time services were stopped.

Customers can still request withdrawals through the exchange's support center, but GOPAX warned that each request requires manual verification and approval, which could delay processing. The exchange has not said when regular trading, deposits or withdrawals will resume.

GOPAX said it intends to move all of its crypto assets into offline wallets as a protective measure, citing recommendations from financial regulators. The company described the suspension as preventive while it reviews potential security risks.

Why it matters

The halt highlights how quickly a threatening message can disrupt access to customer funds at a South Korean exchange, even without evidence of an actual breach. It also puts attention on cold-storage ratios: Financial Supervisory Service data showed GOPAX held 80.54% of user assets offline at the end of September, just above the 80% minimum required under the Virtual Asset User Protection Act. Other major platforms held more, with Upbit at 99.17%, Bithumb at 94.76% and Coinone at 85%, according to Crypto.news.

Background

The suspension came days after the Financial Services Commission urged domestic exchanges to increase cold-wallet holdings following a $6.3 billion Binance hack. The regulator held an emergency meeting with major exchanges on November 2 to review withdrawal approval systems, administrator privileges, internal access controls and transaction monitoring, Crypto.news reported.

In October, the FSC reported cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide and named GOPAX operator Streami among 16 companies involved in earlier security incidents. GOPAX itself reported a customer information leak in October affecting seven customers and two current or former employees. Separately, exchange Prabang suspended services after detecting abnormal hot-wallet withdrawals on October 24 and reported losses of about 100 million won ($70,000), according to Yonhap News Agency. Authorities have not established whether the threatening email is connected to the earlier GOPAX leak.

What to watch

Investors will be watching for a resumption date and for confirmation that the asset transfer to cold storage has been completed. Also worth tracking is whether South Korean authorities raise the cold-storage minimum, which Crypto.news reported has been considered at up to 99% without a final decision. Cointelegraph said it had not received a response from GOPAX, and Crypto.news said the exchange did not reply to its request for comment.

Questions readers ask